addS EAF_NOT_RETURNED_DIRECTLY which works similarly as
EAF_NODIRECTESCAPE. Values pointed to by a given argument may be returned but
not the argument itself. This helps PTA quite noticeably because we mostly
care about tracking points to which given memory location can escape.